Consider these two scenarios – A bank is asked to open an account for a crypto exchange.
A payments firm is about to send funds to a counterparty that provides wallets.
In both cases the compliance team faces the same question: who are we actually dealing with?
The counterparties in question are virtual asset service providers, or VASPs: the exchanges, custodians, wallet providers and transfer services that handle crypto assets on behalf of customers, and that the Financial Action Task Force (FATF) brings within anti-money laundering rules.
Blockchain analytics tools do an excellent job of tracing wallets and transactions.
What they cannot establish is the legal identity, ownership and ultimate control of the company running the service.
That is company data, and it lives in registries, filings and corporate documents, not on the chain.
A gap regulators keep pointing to
FATF’s July 2026 targeted update on virtual assets says jurisdictions still struggle to identify the natural and legal persons carrying out VASP activity, and that offshore VASPs remain a persistent challenge.
Many of the jurisdictions with Travel Rule legislation, which requires VASPs to pass originator and beneficiary details along with transfers, have yet to take related supervisory or enforcement action.
FATF also describes crypto-enabled illicit activity as increasingly complex and interconnected, including scam center operations linked to organised crime.
Singapore shows the same pattern from the licensing side, where VASPs are regulated as digital payment token service providers.
In a written reply to Parliament in August, the Monetary Authority of Singapore said that, out of close to 300 license applications, 37 are currently licensed, with most of the rest rejected or withdrawn.
For a bank or fintech screening a counterparty, the licensed group is small. Establishing who sits behind everyone else becomes a due diligence task, not a license lookup.
What VASP due diligence needs
Checking a crypto counterparty properly means answering four questions that no wallet trace can:
- The right legal entity. Brand names, trading names and group companies blur together. The entity named in the smart contract should be the entity in the official registry, and the one holding any license.
- Ownership and control. Who the ultimate beneficial owners are, who the directors are, and which parent structures sit above the business, often spread across several jurisdictions, including offshore ones.
- Documents, not just data points. Certificates of incorporation, articles and government registry extracts, that a reviewer, auditor or regulator can open and read.
- Change over time. Ownership and status shift after onboarding, so a one-off check ages quickly.
Where Worldbox fits
Worldbox, a global business intelligence provider headquartered in Zurich with offices around the world, including in Singapore, is extending its company intelligence to this segment.
The base is already in place: more than 500 million entities across over 240 jurisdictions, organised in a common schema of 300+ standardised fields.
Data is sourced directly from company registries and backed by original corporate documents.
A research network retrieves non-digitised records and investigates complex ownership structures, including cross-border work on the ownership and control of companies in offshore jurisdictions such as the British Virgin Islands.
Those are the capabilities VASP due diligence leans on, and Worldbox is building VASP and digital-asset entity profiles on top of them.
The aim is to let compliance teams see the company behind a crypto counterparty with the same evidence they expect for any other business.
Worldbox has also completed SOC 2 Type I and Type II certifications, giving banks and fintechs independent assurance over the controls that protect that data.
The data can be reached through Worldbox’s portal and REST API.
Worldbox’s MCP server on AWS Marketplace lets AI agents discover companies, evaluate samples and retrieve purchased intelligence, with consumption controls and AWS billing, so the same checks can feed automated onboarding and monitoring workflows.
Accountability resides with legal entities not blockchains
While blockchains record what happened, it is legal entity records that show who is accountable for it.
Regulators are signaling that institutions will need both. To find out more, visit worldbox.net.
Featured image: Edited by Fintech News Singapore, based on image by user6724086 via Magnific
